Cash App Investing reports downloaded by former employee
On December 10, 2021 a former employee downloaded Cash App Investing reports containing customer names and brokerage account numbers, and for some customers portfolio value and holdings. The employee had regular access to the reports in their past job, but accessed them after their employment ended. Block disclosed the incident in an SEC 8-K on April 4, 2022.
- Victim
- Block (Cash App Investing)
- Industry
- Financial services
- Country
- United States
- Intrusion began
- Dec 10, 2021
- First disclosed
- Apr 4, 2022
- Actor
- Former employee (Insider)
- Initial access
- Insider misuse
- Identity control that failed
- Identity lifecycle
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 8.2 million (About 8.2 million current and former customers contacted, per Block's SEC 8-K.)
- Disclosed cost
- $15 million (Class action settlement (Salinas v. Block, Inc.), final approval reported April 2025.)
The identity lesson
Revoking all access at termination, including to reporting tools and exports, is the control that failed; automated deprovisioning tied to HR events closes the gap.
Regulatory and legal outcome
Reported April 4, 2025: a California federal judge in San Francisco gave final approval to a $15 million class action settlement; Block denied wrongdoing.
Go deeper on SWI
- Technique: Orphaned account abuse
Sources
- Block, Inc. Form 8-K, U.S. Securities and Exchange Commission, Apr 4, 2022
- Judge Approves $15 Million Settlement Of Cash App Data Breach Class Action, Mealey's (LexisNexis), Apr 4, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- CrowdSec private repositories copied with a departing engineer's GitHub token 2026 · OAuth token abuse
- Coinbase customer data stolen through paid overseas support staff 2025 · Insider misuse
- Midnight Blizzard password spray into Microsoft corporate email 2024 · Password spraying
- Colonial Pipeline ransomware via legacy VPN account 2021 · Stolen credentials
Cite this record
SWI Community Team. (2026). Cash App Investing reports downloaded by former employee. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-cash-app-former-employee/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.